CVE-2026-81963 is being exploited in the wild. This vulnerability is an improper link resolution before file access defect in Windows Update Stack. Successful exploitation could allow an authorized attacker to elevate privileges locally. Hence, the risk level of this vulnerability is rated as Medium Risk.
CVE-2026-85880 is being exploited in the wild. A heap-based buffer overflow vulnerability in Windows Advanced Local Procedure Call (ALPC) allows an authorized attacker to elevate privileges locally. An attacker who can execute code from a low-privilege AppContainer can exploit the vulnerability locally to escape the sandbox and elevate privileges on the affected system without requiring additional user interaction. Hence, the risk level of this vulnerability is rated as Medium Risk.
Number of 'Extremely High Risk' product(s): 0
Number of 'High Risk' product(s): 0
Number of 'Medium Risk' product(s): 10
Number of 'Low Risk' product(s): 0
Evaluation of overall 'Risk Level': Medium Risk
Elevation of Privilege
Remote Code Execution
Information Disclosure
Security Restriction Bypass
System / Technologies affected
Extended Security Updates (ESU)
Before installation of the software, please visit the vendor web-site for more details.
Apply fixes issued by the vendor.
Vulnerability Identifier
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
